xccdf_org.open-scap_testresult_xccdf_org.ssgproject.content_profile_stig

SCAP Security Guide · catalog, not a checklist

$ sudo dnf install aide
$ sudo /usr/sbin/aide --init
$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
$ sudo /usr/sbin/aide --check
Fix execution completed and returned: 0
Start timestamp: 2024-08-21 12:36:07 +0000 (AIDE 0.16)
AIDE initialized database at /var/lib/aide/aide.db.new.gz

Number of entries:	160022

---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------

/var/lib/aide/aide.db.new.gz
  MD5      : pVl60qJf7Bmu6lExTv/Xcg==
  SHA1     : pE68xSdK+ZwLgV0QJ/6LWGbKN70=
  RMD160   : mgNpjKsuS7jmw6LfuK8jmi7Oglw=
  TIGER    : zTv3GwtWXxIKdH9ofPbMomqLB6NfC0Oh
  SHA256   : XKgER9jPpG75RC+qqOFfCfQQm2BPpLM3
             N+DC6aEf/90=
  SHA512   : oqAY/RnH4oLJ6fw6XHjdqgVHJ8RpUqER
             ltY9mbYH3G87MutnzeLU3jer4eFjXvzk
             td6y+1arSJzi+TLJnrq2Nw==

End timestamp: 2024-08-21 12:36:31 +0000 (run time: 0m 24s)

Fix execution completed and returned: 0
05 4 * * * root /usr/sbin/aide --check
05 4 * * 0 root /usr/sbin/aide --check
Fix execution completed and returned: 0
 | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost
05 4 * * * root /usr/sbin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost
Fix execution completed and returned: 0
NORMAL = FIPSR+sha512
Fix execution completed and returned: 0
Failed to verify applied fix: Checking engine returns: fail
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi

aide_conf="/etc/aide.conf"
forbidden_hashes=(sha1 rmd160 sha256 whirlpool tiger haval gost crc32)

groups=$(LC_ALL=C grep "^[A-Z][A-Za-z_]*" $aide_conf | cut -f1 -d ' ' | tr -d ' ' | sort -u)

for group in $groups
do
	config=$(grep "^$group\s*=" $aide_conf | cut -f2 -d '=' | tr -d ' ')

	if ! [[ $config = *sha512* ]]
	then
		config=$config"+sha512"
	fi

	for hash in "${forbidden_hashes[@]}"
	do
		config=$(echo $config | sed "s/$hash//")
	done

	config=$(echo $config | sed "s/^\+*//")
	config=$(echo $config | sed "s/\+\++/+/")
	config=$(echo $config | sed "s/\+$//")

	sed -i "s/^$group\s*=.*/$group = $config/g" $aide_conf
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256
Fix execution completed and returned: 0
FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256
Fix execution completed and returned: 0
fips-mode-setup --enable
Fix execution completed and returned: 0
Kernel initramdisks are being regenerated. This might take some time.
Setting system policy to FIPS
Note: System-wide crypto policies are applied on application start-up.
It is recommended to restart the system for the change of policies
to fully take place.
FIPS mode will be enabled.
Please reboot the system for the setting to take effect.
add_dracutmodules+=" fips "

fips-mode-setup --enable
Fix execution completed and returned: 0
Preserving current FIPS-based policy FIPS.
Please review the subpolicies to ensure they only restrict, not relax the FIPS policy.
Setting system policy to FIPS
Note: System-wide crypto policies are applied on application start-up.
It is recommended to restart the system for the change of policies
to fully take place.
FIPS mode will be enabled.
Please reboot the system for the setting to take effect.

Failed to verify applied fix: Checking engine returns: fail
# Remediation is applicable only in certain platforms
if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && ! ( [ "${container:-}" == "bwrap-osbuild" ] ) ) && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then

var_system_crypto_policy='FIPS'

fips-mode-setup --enable

stderr_of_call=$(update-crypto-policies --set ${var_system_crypto_policy} 2>&1 > /dev/null)
rc=$?

if test "$rc" = 127; then
	echo "$stderr_of_call" >&2
	echo "Make sure that the script is installed on the remediated system." >&2
	echo "See output of the 'dnf provides update-crypto-policies' command" >&2
	echo "to see what package to (re)install" >&2

	false  # end with an error code
elif test "$rc" != 0; then
	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
	false  # end with an error code
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

- name: XCCDF Value var_system_crypto_policy # promote to variable
  set_fact:
    var_system_crypto_policy: !!str FIPS
  tags:
    - always

- name: Enable FIPS Mode - Check to See the Current Status of FIPS Mode
  ansible.builtin.command: /usr/bin/fips-mode-setup --check
  register: is_fips_enabled
  failed_when: false
  changed_when: false
  when:
  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    and not ( lookup("env", "container") == "bwrap-osbuild" ) )
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-RHEL-09-671010
  - NIST-800-53-CM-3(6)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - enable_fips_mode
  - high_severity
  - medium_complexity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Enable FIPS Mode - Enable FIPS Mode
  ansible.builtin.command: /usr/bin/fips-mode-setup --enable
  when:
  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    and not ( lookup("env", "container") == "bwrap-osbuild" ) )
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - is_fips_enabled.stdout.find('FIPS mode is enabled.') == -1
  tags:
  - DISA-STIG-RHEL-09-671010
  - NIST-800-53-CM-3(6)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - enable_fips_mode
  - high_severity
  - medium_complexity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Enable FIPS Mode - Configure Crypto Policy
  ansible.builtin.lineinfile:
    path: /etc/crypto-policies/config
    regexp: ^(?!#)(\S+)$
    line: '{{ var_system_crypto_policy }}'
    create: true
  when:
  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    and not ( lookup("env", "container") == "bwrap-osbuild" ) )
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-RHEL-09-671010
  - NIST-800-53-CM-3(6)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - enable_fips_mode
  - high_severity
  - medium_complexity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Enable FIPS Mode - Verify that Crypto Policy is Set (runtime)
  ansible.builtin.command: /usr/bin/update-crypto-policies --set {{ var_system_crypto_policy
    }}
  when:
  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    and not ( lookup("env", "container") == "bwrap-osbuild" ) )
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-RHEL-09-671010
  - NIST-800-53-CM-3(6)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - enable_fips_mode
  - high_severity
  - medium_complexity
  - medium_disruption
  - reboot_required
  - restrict_strategy

[customizations]
fips = true

fips-mode-setup --enable
No suitable fix found.
$ sudo dnf install crypto-policies
$ sudo update-crypto-policies --set FIPS

Fix execution completed and returned: 0
$ sudo grep -i MinProtocol /etc/crypto-policies/back-ends/opensslcnf.config

MinProtocol = TLSv1.2

$ sudo grep -i MinProtocol /etc/crypto-policies/back-ends/opensslcnf.config

TLS.MinProtocol = TLSv1.2
DTLS.MinProtocol = DTLSv1.2
Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr

-oCiphers=aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr

No suitable fix found.
No suitable fix found.
$ sudo dnf install McAfeeTP
No suitable fix found.
No suitable fix found.
part / --fstype=ext4 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE

No candidate or applicable check found.
No suitable fix found.

part /home

[[customizations.filesystem]]
mountpoint = "/home"
size = 1073741824

No suitable fix found.

part /tmp

[[customizations.filesystem]]
mountpoint = "/tmp"
size = 1073741824

No suitable fix found.

part /var

[[customizations.filesystem]]
mountpoint = "/var"
size = 3221225472

No suitable fix found.

part /var/log

[[customizations.filesystem]]
mountpoint = "/var/log"
size = 5368709120

No suitable fix found.

part /var/log/audit

[[customizations.filesystem]]
mountpoint = "/var/log/audit"
size = 10737418240

No suitable fix found.

part /var/tmp

[[customizations.filesystem]]
mountpoint = "/var/tmp"
size = 1073741824

[org/gnome/login-screen]
disable-restart-buttons=true
/org/gnome/login-screen/disable-restart-buttons
[org/gnome/login-screen]
disable-user-list=true
/org/gnome/login-screen/disable-user-list
[org/gnome/settings-daemon/peripherals/smartcard]
removal-action='lock-screen'
/org/gnome/settings-daemon/peripherals/smartcard/removal-action
[daemon]
AutomaticLoginEnable=false
[org/gnome/desktop/media-handling]
automount-open=false
/org/gnome/desktop/media-handling/automount-open
[org/gnome/desktop/media-handling]
autorun-never=true
/org/gnome/desktop/media-handling/autorun-never
[org/gnome/desktop/session]
idle-delay=uint32 900
[org/gnome/desktop/screensaver]
lock-delay=uint32 0

[org/gnome/desktop/screensaver]
lock-enabled=true

/org/gnome/desktop/screensaver/lock-enabled
[org/gnome/desktop/screensaver]
picture-uri=string ''

/org/gnome/desktop/screensaver/picture-uri
/org/gnome/desktop/screensaver/lock-delay
/org/gnome/desktop/session/idle-delay
[org/gnome/settings-daemon/plugins/media-keys]
logout=''
/org/gnome/settings-daemon/plugins/media-keys/logout
dconf update
/etc/dconf/db/distro.d
/etc/dconf/db/local.d
$ sudo dnf install sudo
Fix execution completed and returned: 0
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 38: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 38: unknown option to `s'
sed: -e expression #1, char 38: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 38: unknown option to `s'
sed: -e expression #1, char 38: unknown option to `s'
sed: -e expression #1, char 38: unknown option to `s'
sed: -e expression #1, char 38: unknown option to `s'
sed: -e expression #1, char 38: unknown option to `s'
sed: -e expression #1, char 38: unknown option to `s'
sed: -e expression #1, char 38: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'
sed: -e expression #1, char 38: unknown option to `s'
sed: -e expression #1, char 40: unknown option to `s'

Failed to verify applied fix: Checking engine returns: fail

for f in /etc/sudoers /etc/sudoers.d/* ; do
  if [ ! -e "$f" ] ; then
    continue
  fi
  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "NOPASSWD" matches to preserve user data
      sed -i "s/^${entry}$/# &/g" $f
    done <<< "$matching_list"

    /usr/sbin/visudo -cf $f &> /dev/null || echo "Fail to validate $f with visudo"
  fi
done

- name: Find /etc/sudoers.d/ files
  ansible.builtin.find:
    paths:
    - /etc/sudoers.d/
  register: sudoers
  tags:
  - DISA-STIG-RHEL-09-611085
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-11
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_remove_nopasswd

- name: Remove lines containing NOPASSWD from sudoers files
  ansible.builtin.replace:
    regexp: (^(?!#).*[\s]+NOPASSWD[\s]*\:.*$)
    replace: '# \g<1>'
    path: '{{ item.path }}'
    validate: /usr/sbin/visudo -cf %s
  with_items:
  - path: /etc/sudoers
  - '{{ sudoers.files }}'
  tags:
  - DISA-STIG-RHEL-09-611085
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-11
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_remove_nopasswd

Fix execution completed and returned: 0
 sudo cvtsudoers -f sudoers /etc/sudoers | grep -E '^Defaults !?(rootpw|targetpw|runaspw)$' 
 Defaults !targetpw
      Defaults !rootpw
      Defaults !runaspw 
 sudo find /etc/sudoers /etc/sudoers.d \( \! -name '*~' -a \! -name '*.*' \) -exec grep -E --with-filename '^[[:blank:]]*Defaults[[:blank:]](.*[[:blank:]])?!?\b(rootpw|targetpw|runaspw)' -- {} \; 
 /etc/sudoers:Defaults !targetpw
      /etc/sudoers:Defaults !rootpw
      /etc/sudoers:Defaults !runaspw 
Fix execution completed and returned: 0
$ sudo dnf install gnutls-utils
Fix execution completed and returned: 0
Last metadata expiration check: 2:48:00 ago on Wed Aug 21 09:50:07 2024.
Dependencies resolved.
================================================================================
 Package            Architecture Version                  Repository       Size
================================================================================
Installing:
 gnutls-utils       x86_64       3.8.3-4.el9_4            appstream       287 k
Installing dependencies:
 gnutls-dane        x86_64       3.8.3-4.el9_4            appstream        21 k
 protobuf-c         x86_64       1.3.3-13.el9             baseos           34 k
 unbound-libs       x86_64       1.16.2-3.el9_3.5         appstream       548 k

Transaction Summary
================================================================================
Install  4 Packages

Total download size: 890 k
Installed size: 2.5 M
Downloading Packages:
(1/4): gnutls-utils-3.8.3-4.el9_4.x86_64.rpm    482 kB/s | 287 kB     00:00    
(2/4): protobuf-c-1.3.3-13.el9.x86_64.rpm        55 kB/s |  34 kB     00:00    
(3/4): unbound-libs-1.16.2-3.el9_3.5.x86_64.rpm 805 kB/s | 548 kB     00:00    
(4/4): gnutls-dane-3.8.3-4.el9_4.x86_64.rpm     228 kB/s |  21 kB     00:00    
--------------------------------------------------------------------------------
Total                                           849 kB/s | 890 kB     00:01     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : protobuf-c-1.3.3-13.el9.x86_64                         1/4 
  Running scriptlet: unbound-libs-1.16.2-3.el9_3.5.x86_64                   2/4 
  Installing       : unbound-libs-1.16.2-3.el9_3.5.x86_64                   2/4 
  Running scriptlet: unbound-libs-1.16.2-3.el9_3.5.x86_64                   2/4 
Created symlink /etc/systemd/system/timers.target.wants/unbound-anchor.timer → /usr/lib/systemd/system/unbound-anchor.timer.

  Installing       : gnutls-dane-3.8.3-4.el9_4.x86_64                       3/4 
  Installing       : gnutls-utils-3.8.3-4.el9_4.x86_64                      4/4 
  Running scriptlet: gnutls-utils-3.8.3-4.el9_4.x86_64                      4/4 
  Verifying        : protobuf-c-1.3.3-13.el9.x86_64                         1/4 
  Verifying        : unbound-libs-1.16.2-3.el9_3.5.x86_64                   2/4 
  Verifying        : gnutls-utils-3.8.3-4.el9_4.x86_64                      3/4 
  Verifying        : gnutls-dane-3.8.3-4.el9_4.x86_64                       4/4 

Installed:
  gnutls-dane-3.8.3-4.el9_4.x86_64     gnutls-utils-3.8.3-4.el9_4.x86_64       
  protobuf-c-1.3.3-13.el9.x86_64       unbound-libs-1.16.2-3.el9_3.5.x86_64    

Complete!

$ sudo dnf install nss-tools
Fix execution completed and returned: 0
Last metadata expiration check: 2:48:04 ago on Wed Aug 21 09:50:07 2024.
Dependencies resolved.
================================================================================
 Package          Architecture  Version                  Repository        Size
================================================================================
Installing:
 nss-tools        x86_64        3.90.0-7.el9_4           appstream        431 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 431 k
Installed size: 1.3 M
Downloading Packages:
nss-tools-3.90.0-7.el9_4.x86_64.rpm             337 kB/s | 431 kB     00:01    
--------------------------------------------------------------------------------
Total                                           288 kB/s | 431 kB     00:01     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : nss-tools-3.90.0-7.el9_4.x86_64                        1/1 
  Running scriptlet: nss-tools-3.90.0-7.el9_4.x86_64                        1/1 
  Verifying        : nss-tools-3.90.0-7.el9_4.x86_64                        1/1 

Installed:
  nss-tools-3.90.0-7.el9_4.x86_64                                               

Complete!

$ sudo dnf install rng-tools
$ sudo dnf install subscription-manager
Fix execution completed and returned: 0
Last metadata expiration check: 2:48:07 ago on Wed Aug 21 09:50:07 2024.
Dependencies resolved.
=======================================================================================
 Package                                  Arch    Version                 Repo     Size
=======================================================================================
Installing:
 subscription-manager                     x86_64  1.29.40-1.el9.rocky.0.1 baseos  778 k
Installing dependencies:
 libdnf-plugin-subscription-manager       x86_64  1.29.40-1.el9.rocky.0.1 baseos   60 k
 python3-cloud-what                       x86_64  1.29.40-1.el9.rocky.0.1 baseos   71 k
 python3-decorator                        noarch  4.4.2-6.el9             baseos   27 k
 python3-iniparse                         noarch  0.4-45.el9              baseos   42 k
 python3-inotify                          noarch  0.9.6-25.el9            baseos   52 k
 python3-librepo                          x86_64  1.14.5-2.el9            baseos   47 k
 python3-subscription-manager-rhsm        x86_64  1.29.40-1.el9.rocky.0.1 baseos  153 k
 subscription-manager-rhsm-certificates   noarch  20220623-1.el9          baseos   20 k
 usermode                                 x86_64  1.114-4.el9             baseos  175 k
 virt-what                                x86_64  1.25-5.el9              baseos   33 k

Transaction Summary
=======================================================================================
Install  11 Packages

Total download size: 1.4 M
Installed size: 5.4 M
Downloading Packages:
(1/11): python3-decorator-4.4.2-6.el9.noarch.rp  34 kB/s |  27 kB     00:00    
(2/11): python3-iniparse-0.4-45.el9.noarch.rpm   52 kB/s |  42 kB     00:00    
(3/11): usermode-1.114-4.el9.x86_64.rpm         191 kB/s | 175 kB     00:00    
(4/11): python3-inotify-0.9.6-25.el9.noarch.rpm 406 kB/s |  52 kB     00:00    
(5/11): python3-librepo-1.14.5-2.el9.x86_64.rpm 368 kB/s |  47 kB     00:00    
(6/11): virt-what-1.25-5.el9.x86_64.rpm         130 kB/s |  33 kB     00:00    
(7/11): python3-subscription-manager-rhsm-1.29. 1.1 MB/s | 153 kB     00:00    
(8/11): python3-cloud-what-1.29.40-1.el9.rocky. 277 kB/s |  71 kB     00:00    
(9/11): libdnf-plugin-subscription-manager-1.29 448 kB/s |  60 kB     00:00    
(10/11): subscription-manager-1.29.40-1.el9.roc 1.5 MB/s | 778 kB     00:00    
(11/11): subscription-manager-rhsm-certificates 145 kB/s |  20 kB     00:00    
--------------------------------------------------------------------------------
Total                                           903 kB/s | 1.4 MB     00:01     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : subscription-manager-rhsm-certificates-20220623-1.    1/11 
  Installing       : python3-cloud-what-1.29.40-1.el9.rocky.0.1.x86_64     2/11 
  Installing       : python3-iniparse-0.4-45.el9.noarch                    3/11 
  Installing       : python3-subscription-manager-rhsm-1.29.40-1.el9.ro    4/11 
  Installing       : libdnf-plugin-subscription-manager-1.29.40-1.el9.r    5/11 
  Installing       : python3-librepo-1.14.5-2.el9.x86_64                   6/11 
  Installing       : python3-inotify-0.9.6-25.el9.noarch                   7/11 
  Installing       : virt-what-1.25-5.el9.x86_64                           8/11 
  Installing       : usermode-1.114-4.el9.x86_64                           9/11 
  Installing       : python3-decorator-4.4.2-6.el9.noarch                 10/11 
  Running scriptlet: subscription-manager-1.29.40-1.el9.rocky.0.1.x86_6   11/11 
  Installing       : subscription-manager-1.29.40-1.el9.rocky.0.1.x86_6   11/11 
  Running scriptlet: subscription-manager-1.29.40-1.el9.rocky.0.1.x86_6   11/11 
Created symlink /etc/systemd/system/multi-user.target.wants/rhsmcertd.service → /usr/lib/systemd/system/rhsmcertd.service.

  Verifying        : python3-decorator-4.4.2-6.el9.noarch                  1/11 
  Verifying        : usermode-1.114-4.el9.x86_64                           2/11 
  Verifying        : python3-iniparse-0.4-45.el9.noarch                    3/11 
  Verifying        : virt-what-1.25-5.el9.x86_64                           4/11 
  Verifying        : python3-inotify-0.9.6-25.el9.noarch                   5/11 
  Verifying        : python3-librepo-1.14.5-2.el9.x86_64                   6/11 
  Verifying        : subscription-manager-1.29.40-1.el9.rocky.0.1.x86_6    7/11 
  Verifying        : python3-subscription-manager-rhsm-1.29.40-1.el9.ro    8/11 
  Verifying        : python3-cloud-what-1.29.40-1.el9.rocky.0.1.x86_64     9/11 
  Verifying        : libdnf-plugin-subscription-manager-1.29.40-1.el9.r   10/11 
  Verifying        : subscription-manager-rhsm-certificates-20220623-1.   11/11 

Installed:
  libdnf-plugin-subscription-manager-1.29.40-1.el9.rocky.0.1.x86_64             
  python3-cloud-what-1.29.40-1.el9.rocky.0.1.x86_64                             
  python3-decorator-4.4.2-6.el9.noarch                                          
  python3-iniparse-0.4-45.el9.noarch                                            
  python3-inotify-0.9.6-25.el9.noarch                                           
  python3-librepo-1.14.5-2.el9.x86_64                                           
  python3-subscription-manager-rhsm-1.29.40-1.el9.rocky.0.1.x86_64              
  subscription-manager-1.29.40-1.el9.rocky.0.1.x86_64                           
  subscription-manager-rhsm-certificates-20220623-1.el9.noarch                  
  usermode-1.114-4.el9.x86_64                                                   
  virt-what-1.25-5.el9.x86_64                                                   

Complete!

$ sudo dnf erase gssproxy
$ sudo dnf erase iprutils
$ sudo dnf erase tuned
gpgcheck=1
gpgcheck=0
$ sudo subscription-manager register
$ sudo rpm --import /media/cdrom/RPM-GPG-KEY
sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
No candidate or applicable check found.
[org/gnome/login-screen]
banner-message-enable=true
/org/gnome/login-screen/banner-message-enable
Fix execution completed and returned: 0
Fix execution completed and returned: 0
Current configuration is valid.
Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.

Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-19.FQOgRs
Changes were successfully applied.

Fix execution completed and returned: 0
Current configuration is valid.
Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.

Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-19.5qJATP
Changes were successfully applied.

authselect enable-feature with-pwhistory
Fix execution completed and returned: 0
Current configuration is valid.
Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.

Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-19.ZwsZYO
Changes were successfully applied.
Current configuration is valid.
New profile was created at /etc/authselect/custom/hardening
Backup stored at /var/lib/authselect/backups/before-hardening-custom-profile
Changes were successfully applied.
Profile "custom/hardening" was selected.
The following nsswitch maps are overwritten by the profile:
- passwd
- group
- netgroup
- automount
- services

Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.

Backup stored at /var/lib/authselect/backups/after-hardening-custom-profile
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-20.64YRMq
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-20.2xWuHs
Changes were successfully applied.

authselect enable-feature with-pwhistory
Fix execution completed and returned: 0
Current configuration is valid.
Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.

Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-20.mbtx4t
Changes were successfully applied.
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-20.qPLc4D
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-20.wgUlKN
Changes were successfully applied.

Fix execution completed and returned: 0
Current configuration is valid.
Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.

Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-20.2rZ4Zs
Changes were successfully applied.
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-20.MEpE3C
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-20.YyIMn5
Changes were successfully applied.
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-20.k9GuW6
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-20.aM3mda
Changes were successfully applied.

Fix execution completed and returned: 0
Current configuration is valid.
Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.

Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.a2VrBi
Changes were successfully applied.
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.7dzsVN
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.7e7J4z
Changes were successfully applied.
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.6wbJ3q
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.efLoiY
Changes were successfully applied.

Fix execution completed and returned: 0
Current configuration is valid.
Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.

Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.xcOzr3
Changes were successfully applied.
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.2AFdfV
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.tnsKE0
Changes were successfully applied.
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.nxYzx6
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.aoxJUq
Changes were successfully applied.

Note that the default directory that "pam_faillock" uses is usually cleared on system
boot so the access will be reenabled after system reboot. If that is undesirable, a different
tally directory must be set with the "dir" option.
Fix execution completed and returned: 0
Current configuration is valid.
Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.

Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.2ZLHiq
Changes were successfully applied.
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.asNBBI
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.1P0L7E
Changes were successfully applied.
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.c1A00Q
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-21.DCerNv
Changes were successfully applied.
Relabeled /var/log/faillock from unconfined_u:object_r:var_log_t:s0 to unconfined_u:object_r:faillog_t:s0

Fix execution completed and returned: 0
Current configuration is valid.
Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.

Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-23.gWBFnX
Changes were successfully applied.
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-23.Snq4RQ
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-23.fSr2Ko
Changes were successfully applied.
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-23.xzaKQj
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-23.LDZatZ
Changes were successfully applied.

Fix execution completed and returned: 0
Current configuration is valid.
Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.

Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-23.zjOJCL
Changes were successfully applied.
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-23.rjvBLP
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-23.pNJiS6
Changes were successfully applied.
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-23.qGg7wP
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-23.i4a6JN
Changes were successfully applied.

Fix execution completed and returned: 0
Fix execution completed and returned: 0
Fix execution completed and returned: 0
Fix execution completed and returned: 0
Fix execution completed and returned: 0
* Upper-case characters
* Lower-case characters
* Digits
* Special characters (for example, punctuation)

Fix execution completed and returned: 0
Fix execution completed and returned: 0
Fix execution completed and returned: 0
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-24.FSeDsp
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-24.xLBHMM
Changes were successfully applied.
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-24.IQaKox
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-24.kgkruh
Changes were successfully applied.

crypt_style = sha512
ENCRYPT_METHOD SHA512

password    sufficient    pam_unix.so sha512 other arguments...

SHA_CRYPT_MIN_ROUNDS 5000
SHA_CRYPT_MAX_ROUNDS 5000
$ sudo grep pam_succeed_if /etc/pam.d/sudo
session     [default=1]    pam_lastlog.so showfailed
$ tmux
ctrl+b :lock-session
Fix execution completed and returned: 0
Last metadata expiration check: 2:48:21 ago on Wed Aug 21 09:50:07 2024.
Dependencies resolved.
================================================================================
 Package        Architecture     Version                 Repository        Size
================================================================================
Installing:
 tmux           x86_64           3.2a-5.el9              baseos           475 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 475 k
Installed size: 1.1 M
Downloading Packages:
tmux-3.2a-5.el9.x86_64.rpm                      347 kB/s | 475 kB     00:01    
--------------------------------------------------------------------------------
Total                                           303 kB/s | 475 kB     00:01     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : tmux-3.2a-5.el9.x86_64                                 1/1 
  Running scriptlet: tmux-3.2a-5.el9.x86_64                                 1/1 
  Verifying        : tmux-3.2a-5.el9.x86_64                                 1/1 
Installed products updated.

Installed:
  tmux-3.2a-5.el9.x86_64                                                        

Complete!

set -g lock-command vlock
ctrl+b :lock-session
bind X lock-session
Ctrl+b Shift+x
$ sudo dnf install opensc
Fix execution completed and returned: 0
Last metadata expiration check: 2:48:25 ago on Wed Aug 21 09:50:07 2024.
Dependencies resolved.
================================================================================
 Package               Architecture  Version                Repository     Size
================================================================================
Installing:
 opensc                x86_64        0.23.0-4.el9_3         baseos        1.3 M
Installing dependencies:
 pcsc-lite             x86_64        1.9.4-1.el9            baseos         91 k
 pcsc-lite-ccid        x86_64        1.5.2-1.el9            baseos        326 k
 pcsc-lite-libs        x86_64        1.9.4-1.el9            baseos         27 k

Transaction Summary
================================================================================
Install  4 Packages

Total download size: 1.7 M
Installed size: 5.8 M
Downloading Packages:
(1/4): pcsc-lite-libs-1.9.4-1.el9.x86_64.rpm     41 kB/s |  27 kB     00:00    
(2/4): pcsc-lite-ccid-1.5.2-1.el9.x86_64.rpm    371 kB/s | 326 kB     00:00    
(3/4): opensc-0.23.0-4.el9_3.x86_64.rpm         1.3 MB/s | 1.3 MB     00:00    
(4/4): pcsc-lite-1.9.4-1.el9.x86_64.rpm         267 kB/s |  91 kB     00:00    
--------------------------------------------------------------------------------
Total                                           1.4 MB/s | 1.7 MB     00:01     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : pcsc-lite-libs-1.9.4-1.el9.x86_64                      1/4 
  Installing       : pcsc-lite-1.9.4-1.el9.x86_64                           2/4 
  Running scriptlet: pcsc-lite-1.9.4-1.el9.x86_64                           2/4 
Created symlink /etc/systemd/system/sockets.target.wants/pcscd.socket → /usr/lib/systemd/system/pcscd.socket.

  Installing       : pcsc-lite-ccid-1.5.2-1.el9.x86_64                      3/4 
  Running scriptlet: pcsc-lite-ccid-1.5.2-1.el9.x86_64                      3/4 
  Installing       : opensc-0.23.0-4.el9_3.x86_64                           4/4 
  Running scriptlet: opensc-0.23.0-4.el9_3.x86_64                           4/4 
  Verifying        : opensc-0.23.0-4.el9_3.x86_64                           1/4 
  Verifying        : pcsc-lite-ccid-1.5.2-1.el9.x86_64                      2/4 
  Verifying        : pcsc-lite-libs-1.9.4-1.el9.x86_64                      3/4 
  Verifying        : pcsc-lite-1.9.4-1.el9.x86_64                           4/4 
Installed products updated.

Installed:
  opensc-0.23.0-4.el9_3.x86_64           pcsc-lite-1.9.4-1.el9.x86_64          
  pcsc-lite-ccid-1.5.2-1.el9.x86_64      pcsc-lite-libs-1.9.4-1.el9.x86_64     

Complete!

$ sudo dnf install pcsc-lite
Fix execution completed and returned: 0
$ sudo dnf install openssl-pkcs11
Fix execution completed and returned: 0
Last metadata expiration check: 2:48:29 ago on Wed Aug 21 09:50:07 2024.
Dependencies resolved.
================================================================================
 Package               Architecture  Version                Repository     Size
================================================================================
Installing:
 openssl-pkcs11        x86_64        0.4.11-9.el9           baseos         71 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 71 k
Installed size: 201 k
Downloading Packages:
openssl-pkcs11-0.4.11-9.el9.x86_64.rpm          113 kB/s |  71 kB     00:00    
--------------------------------------------------------------------------------
Total                                            90 kB/s |  71 kB     00:00     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : openssl-pkcs11-0.4.11-9.el9.x86_64                     1/1 
  Running scriptlet: openssl-pkcs11-0.4.11-9.el9.x86_64                     1/1 
  Verifying        : openssl-pkcs11-0.4.11-9.el9.x86_64                     1/1 
Installed products updated.

Installed:
  openssl-pkcs11-0.4.11-9.el9.x86_64                                            

Complete!

$ sudo systemctl enable pcscd.service
Fix execution completed and returned: 0
app default {
   ...
   card_drivers = cac;
}

Fix execution completed and returned: 0
$ sudo systemctl mask --now debug-shell.service
Fix execution completed and returned: 0
Created symlink /etc/systemd/system/debug-shell.service → /dev/null.
Failed to reset failed state of unit debug-shell.service: Unit debug-shell.service not loaded.

CtrlAltDelBurstAction=none
Fix execution completed and returned: 0
ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target
systemctl mask ctrl-alt-del.target
Fix execution completed and returned: 0
Removed "/etc/systemd/system/ctrl-alt-del.target".
Created symlink /etc/systemd/system/ctrl-alt-del.target → /dev/null.

systemd.confirm_spawn=(1|yes|true|on)
/sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"
grub2-mkconfig -o /boot/grub2/grub.cfg
[Login]
StopIdleSessionSec=900

INACTIVE=35

$ sudo chage -E YYYY-MM-DD USER

No candidate or applicable check found.
PASS_MAX_DAYS 60

Fix execution completed and returned: 0
PASS_MIN_DAYS 1

PASS_MIN_LEN 15

Fix execution completed and returned: 0
$ sudo chage -M 60
                    USER

Fix execution completed and returned: 0
$ sudo chage -m 1 USER

Fix execution completed and returned: 0
$ sudo cut -d: -f2 /etc/shadow
$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/
password sufficient pam_unix.so ...existing_options... rounds=5000

Fix execution completed and returned: 0
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-41.88AvyB
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-41.ddcAGn
Changes were successfully applied.

password sufficient pam_unix.so ...existing_options... rounds=5000

Fix execution completed and returned: 0
Current configuration is valid.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-41.StB6PQ
Changes were successfully applied.
Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-41.QyNdpZ
Changes were successfully applied.

Fix execution completed and returned: 0
Current configuration is valid.
Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.

Backup stored at /var/lib/authselect/backups/2024-08-21-12-38-41.nR9haF
Changes were successfully applied.

$ sudo awk -F: '!$2 {print $1}' /etc/shadow
$ sudo passwd [username]
$ sudo passwd -l [username]
$ sudo usermod -s /sbin/nologin account

Fix execution completed and returned: 0
awk: cmd. line:2: warning: escape sequence `\/' treated as plain `/'
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes
usermod: no changes

auth required pam_wheel.so use_uid
$ sudo userdel unauthorized_user

No suitable fix found.
umask 077

Fix execution completed and returned: 0
umask 077

Fix execution completed and returned: 0
UMASK 077

Fix execution completed and returned: 0
umask 077

Fix execution completed and returned: 0
CREATE_HOME yes
FAIL_DELAY 4

Fix execution completed and returned: 0
* hard maxlogins 10

Fix execution completed and returned: 0
typeset -xr TMOUT=600

declare -xr TMOUT=600

Fix execution completed and returned: 0
$ sudo chmod o-w FILE

No candidate or applicable check found.
$ sudo mkdir /home/USER

$ sudo chgrp USER_GROUP /home/USER

$ sudo chmod 0740 /root/.INIT_FILE
$ sudo chmod 0740 /home/USER/.INIT_FILE

Fix execution completed and returned: 0
$ sudo chmod 0750 /home/USER

$ sudo chgrp root /boot/grub2/grub.cfg
$ sudo chown root /boot/grub2/grub.cfg 
$ sed -i 's/$set superusers=$.*/\1"<unique user ID>"/g' /etc/grub.d/01_users
grubby --update-kernel=ALL
# grub2-setpassword
GRUB_CMDLINE_LINUX="... pti=on ..."
# grubby --update-kernel=ALL --args="pti=on"
Fix execution completed and returned: 0
GRUB_CMDLINE_LINUX="... vsyscall=none ..."
# grubby --update-kernel=ALL --args="vsyscall=none"
Fix execution completed and returned: 0
cron.*                                                  /var/log/cron
Fix execution completed and returned: 0
Fix execution completed and returned: 0
Fix execution completed and returned: 0
auth.*;authpriv.*;daemon.*                              /var/log/secure
Fix execution completed and returned: 0
$ sudo systemctl enable systemd-journald.service
$ModLoad imtcp
$InputTCPServerRun port
$ModLoad imudp
$UDPServerRun port
$ModLoad imrelp
$InputRELPServerRun port

module(load="imtcp")
module(load="imudp")
input(type="imtcp" port="514")
input(type="imudp" port="514")

*.* @logcollector

*.* @@logcollector

*.* :omrelp:logcollector

$ActionQueueType LinkedList
$ActionQueueFileName queuefilename
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionResumeRetryCount -1

Fix execution completed and returned: 0
$ sudo dnf install rsyslog-gnutls
Fix execution completed and returned: 0
Last metadata expiration check: 2:48:37 ago on Wed Aug 21 09:50:07 2024.
Dependencies resolved.
================================================================================
 Package              Architecture Version                Repository       Size
================================================================================
Installing:
 rsyslog-gnutls       x86_64       8.2310.0-4.el9         appstream        30 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 30 k
Installed size: 54 k
Downloading Packages:
rsyslog-gnutls-8.2310.0-4.el9.x86_64.rpm         39 kB/s |  30 kB     00:00    
--------------------------------------------------------------------------------
Total                                            32 kB/s |  30 kB     00:00     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : rsyslog-gnutls-8.2310.0-4.el9.x86_64                   1/1 
  Running scriptlet: rsyslog-gnutls-8.2310.0-4.el9.x86_64                   1/1 
  Verifying        : rsyslog-gnutls-8.2310.0-4.el9.x86_64                   1/1 
Installed products updated.

Installed:
  rsyslog-gnutls-8.2310.0-4.el9.x86_64                                          

Complete!

 $ sudo dnf install rsyslog
$ sudo systemctl enable rsyslog.service
$ sudo dnf install firewalld
Fix execution completed and returned: 0
Last metadata expiration check: 2:48:40 ago on Wed Aug 21 09:50:07 2024.
Dependencies resolved.
================================================================================
 Package                   Arch        Version             Repository      Size
================================================================================
Installing:
 firewalld                 noarch      1.3.4-1.el9         baseos         450 k
Installing dependencies:
 firewalld-filesystem      noarch      1.3.4-1.el9         baseos         8.3 k
 ipset                     x86_64      7.11-8.el9          baseos          42 k
 ipset-libs                x86_64      7.11-8.el9          baseos          69 k
 python3-firewall          noarch      1.3.4-1.el9         baseos         348 k
 python3-nftables          x86_64      1:1.0.9-1.el9       baseos          22 k
Installing weak dependencies:
 libcap-ng-python3         x86_64      0.8.2-7.el9         appstream       29 k

Transaction Summary
================================================================================
Install  7 Packages

Total download size: 968 k
Installed size: 4.4 M
Downloading Packages:
(1/7): firewalld-filesystem-1.3.4-1.el9.noarch.  33 kB/s | 8.3 kB     00:00    
(2/7): ipset-libs-7.11-8.el9.x86_64.rpm         238 kB/s |  69 kB     00:00    
(3/7): python3-firewall-1.3.4-1.el9.noarch.rpm  540 kB/s | 348 kB     00:00    
(4/7): ipset-7.11-8.el9.x86_64.rpm              377 kB/s |  42 kB     00:00    
(5/7): firewalld-1.3.4-1.el9.noarch.rpm         614 kB/s | 450 kB     00:00    
(6/7): python3-nftables-1.0.9-1.el9.x86_64.rpm  224 kB/s |  22 kB     00:00    
(7/7): libcap-ng-python3-0.8.2-7.el9.x86_64.rpm 115 kB/s |  29 kB     00:00    
--------------------------------------------------------------------------------
Total                                           742 kB/s | 968 kB     00:01     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Running scriptlet: firewalld-1.3.4-1.el9.noarch                           1/1 
  Preparing        :                                                        1/1 
  Installing       : libcap-ng-python3-0.8.2-7.el9.x86_64                   1/7 
  Installing       : python3-nftables-1:1.0.9-1.el9.x86_64                  2/7 
  Installing       : python3-firewall-1.3.4-1.el9.noarch                    3/7 
  Installing       : ipset-libs-7.11-8.el9.x86_64                           4/7 
  Installing       : ipset-7.11-8.el9.x86_64                                5/7 
  Installing       : firewalld-filesystem-1.3.4-1.el9.noarch                6/7 
  Installing       : firewalld-1.3.4-1.el9.noarch                           7/7 
  Running scriptlet: firewalld-1.3.4-1.el9.noarch                           7/7 
Created symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service → /usr/lib/systemd/system/firewalld.service.
Created symlink /etc/systemd/system/multi-user.target.wants/firewalld.service → /usr/lib/systemd/system/firewalld.service.

  Verifying        : python3-firewall-1.3.4-1.el9.noarch                    1/7 
  Verifying        : firewalld-filesystem-1.3.4-1.el9.noarch                2/7 
  Verifying        : firewalld-1.3.4-1.el9.noarch                           3/7 
  Verifying        : ipset-libs-7.11-8.el9.x86_64                           4/7 
  Verifying        : ipset-7.11-8.el9.x86_64                                5/7 
  Verifying        : python3-nftables-1:1.0.9-1.el9.x86_64                  6/7 
  Verifying        : libcap-ng-python3-0.8.2-7.el9.x86_64                   7/7 
Installed products updated.

Installed:
  firewalld-1.3.4-1.el9.noarch          firewalld-filesystem-1.3.4-1.el9.noarch
  ipset-7.11-8.el9.x86_64               ipset-libs-7.11-8.el9.x86_64           
  libcap-ng-python3-0.8.2-7.el9.x86_64  python3-firewall-1.3.4-1.el9.noarch    
  python3-nftables-1:1.0.9-1.el9.x86_64

Complete!

$ sudo systemctl enable firewalld.service
firewall-cmd --permanent --add-port=port_number/tcp

firewall-cmd --permanent --add-service=service_name

No candidate or applicable check found.
No candidate or applicable check found.
$ sudo dnf install libreswan
Fix execution completed and returned: 0
Last metadata expiration check: 2:48:45 ago on Wed Aug 21 09:50:07 2024.
Dependencies resolved.
================================================================================
 Package          Architecture  Version                  Repository        Size
================================================================================
Installing:
 libreswan        x86_64        4.12-2.el9_4.1           appstream        1.3 M
Installing dependencies:
 ldns             x86_64        1.7.1-11.el9             appstream        160 k

Transaction Summary
================================================================================
Install  2 Packages

Total download size: 1.5 M
Installed size: 5.6 M
Downloading Packages:
(1/2): ldns-1.7.1-11.el9.x86_64.rpm             217 kB/s | 160 kB     00:00    
(2/2): libreswan-4.12-2.el9_4.1.x86_64.rpm      820 kB/s | 1.3 MB     00:01    
--------------------------------------------------------------------------------
Total                                           826 kB/s | 1.5 MB     00:01     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : ldns-1.7.1-11.el9.x86_64                               1/2 
  Installing       : libreswan-4.12-2.el9_4.1.x86_64                        2/2 
  Running scriptlet: libreswan-4.12-2.el9_4.1.x86_64                        2/2 
  Verifying        : libreswan-4.12-2.el9_4.1.x86_64                        1/2 
  Verifying        : ldns-1.7.1-11.el9.x86_64                               2/2 
Installed products updated.

Installed:
  ldns-1.7.1-11.el9.x86_64            libreswan-4.12-2.el9_4.1.x86_64           

Complete!

No candidate or applicable check found.
$ sudo sysctl -w net.ipv6.conf.all.accept_ra=0
net.ipv6.conf.all.accept_ra = 0
$ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0
net.ipv6.conf.all.accept_redirects = 0
$ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0
net.ipv6.conf.all.accept_source_route = 0
$ sudo sysctl -w net.ipv6.conf.all.forwarding=0
net.ipv6.conf.all.forwarding = 0
$ sudo sysctl -w net.ipv6.conf.default.accept_ra=0
net.ipv6.conf.default.accept_ra = 0
$ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0
net.ipv6.conf.default.accept_redirects = 0
Fix execution completed and returned: 0
grep: /run/sysctl.d/*.conf: No such file or directory
grep: /usr/local/lib/sysctl.d/*.conf: No such file or directory

$ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0
net.ipv6.conf.default.accept_source_route = 0
$ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0
net.ipv4.conf.all.accept_redirects = 0
$ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0
net.ipv4.conf.all.accept_source_route = 0
$ sudo sysctl -w net.ipv4.conf.all.forwarding=0
net.ipv4.conf.all.forwarding = 0
Fix execution completed and returned: 0
grep: /run/sysctl.d/*.conf: No such file or directory
grep: /usr/local/lib/sysctl.d/*.conf: No such file or directory

$ sudo sysctl -w net.ipv4.conf.all.log_martians=1
net.ipv4.conf.all.log_martians = 1
$ sudo sysctl -w net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.all.rp_filter = 1
$ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0
net.ipv4.conf.default.accept_redirects = 0
Fix execution completed and returned: 0
grep: /run/sysctl.d/*.conf: No such file or directory
grep: /usr/local/lib/sysctl.d/*.conf: No such file or directory

$ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0
net.ipv4.conf.default.accept_source_route = 0
$ sudo sysctl -w net.ipv4.conf.default.log_martians=1
net.ipv4.conf.default.log_martians = 1
$ sudo sysctl -w net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.default.rp_filter = 1
$ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_echo_ignore_broadcasts = 1
$ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.icmp_ignore_bogus_error_responses = 1
$ sudo sysctl -w net.ipv4.tcp_syncookies=1
net.ipv4.tcp_syncookies = 1
$ sudo sysctl -w net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.all.send_redirects = 0
$ sudo sysctl -w net.ipv4.conf.default.send_redirects=0
net.ipv4.conf.default.send_redirects = 0
install atm /bin/true
Fix execution completed and returned: 0
grep: /etc/modprobe.d/atm.conf: No such file or directory

install can /bin/true
Fix execution completed and returned: 0
grep: /etc/modprobe.d/can.conf: No such file or directory

install firewire-core /bin/true
Fix execution completed and returned: 0
grep: /etc/modprobe.d/firewire-core.conf: No such file or directory

install sctp /bin/true
Fix execution completed and returned: 0
grep: /etc/modprobe.d/sctp.conf: No such file or directory

install tipc /bin/true
install bluetooth /bin/true
Fix execution completed and returned: 0
grep: /etc/modprobe.d/bluetooth.conf: No such file or directory

$ sudo nmcli radio all off
Fix execution completed and returned: 0
$ sudo grep hosts /etc/nsswitch.conf
hosts: files dns
$ sudo ls -al /etc/resolv.conf
-rw-r--r-- 1 root root 0 Aug 19 08:31 resolv.conf
search example.com
nameserver 192.168.0.1
nameserver 192.168.0.2
No suitable fix found.
$ ip link | grep PROMISC
$ sudo ip link set dev device_name multicast off promisc off
$ sudo chgrp root /etc/group-
$ sudo chgrp root /etc/gshadow-
$ sudo chgrp root /etc/passwd-
$ sudo chgrp root /etc/shadow-
$ sudo chgrp root /etc/group
$ sudo chgrp root /etc/gshadow
$ sudo chgrp root /etc/passwd
$ sudo chgrp root /etc/shadow
$ sudo chown root /etc/group- 
$ sudo chown root /etc/gshadow- 
$ sudo chown root /etc/passwd- 
$ sudo chown root /etc/shadow- 
$ sudo chown root /etc/group 
$ sudo chown root /etc/gshadow 
$ sudo chown root /etc/passwd 
$ sudo chown root /etc/shadow 
$ sudo chmod 0644 /etc/group-
$ sudo chmod 0000 /etc/gshadow-
$ sudo chmod 0644 /etc/passwd-
$ sudo chmod 0000 /etc/shadow-
$ sudo chmod 0644 /etc/group
$ sudo chmod 0000 /etc/gshadow
$ sudo chmod 0644 /etc/passwd
$ sudo chmod 0000 /etc/shadow
$ sudo chgrp root /var/log
$ sudo chgrp root /var/log/messages
$ sudo chown root /var/log 
$ sudo chown root /var/log/messages 
$ sudo chmod 0755 /var/log
$ sudo chmod 0640 /var/log/messages
/lib
/lib64
/usr/lib
/usr/lib64

$ sudo chgrp root DIR

/lib
/lib64
/usr/lib
/usr/lib64

$ sudo chown root DIR

/lib
/lib64
/usr/lib
/usr/lib64

$ sudo chmod go-w DIR

/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin

$ sudo chgrp root FILE

/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin
$ sudo chown root FILE

/lib
/lib64
/usr/lib
/usr/lib64

$ sudo chown root FILE

/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin
$ sudo chmod go-w FILE

/lib
/lib64
/usr/lib
/usr/lib64

$ sudo chmod go-w FILE

/lib
/lib64
/usr/lib
/usr/lib64

$ sudo chgrp root FILE

$ sudo chmod +t DIR

$ sudo chmod 0640 /etc/audit/auditd.conf
$ sudo chmod 0640 /etc/audit/rules.d/*.rules
$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)
$ sudo find MOUNTPOINT -xdev -nogroup 2>/dev/null
$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)
$ sudo find MOUNTPOINT -xdev -nouser 2>/dev/null
getent passwd
enumerate = true
$ sudo sysctl -w fs.protected_hardlinks=1
fs.protected_hardlinks = 1
$ sudo sysctl -w fs.protected_symlinks=1
fs.protected_symlinks = 1
$ sudo systemctl mask --now autofs.service
install cramfs /bin/true
Fix execution completed and returned: 0
grep: /etc/modprobe.d/cramfs.conf: No such file or directory

install usb-storage /bin/true
Fix execution completed and returned: 0
grep: /etc/modprobe.d/usb-storage.conf: No such file or directory

Fix execution completed and returned: 0
Fix execution completed and returned: 0
Fix execution completed and returned: 0
Fix execution completed and returned: 0
Fix execution completed and returned: 0
Fix execution completed and returned: 0
Fix execution completed and returned: 0
Fix execution completed and returned: 0
Created symlink /etc/systemd/system/systemd-coredump.socket → /dev/null.

*     hard   core    0
Fix execution completed and returned: 0
$ sudo sysctl -w kernel.kptr_restrict=1

kernel.kptr_restrict = 1

$ sudo sysctl -w kernel.randomize_va_space=2
kernel.randomize_va_space = 2
Fix execution completed and returned: 0
grep: /run/sysctl.d/*.conf: No such file or directory
grep: /usr/local/lib/sysctl.d/*.conf: No such file or directory

GRUB_CMDLINE_LINUX="... page_poison=1 ..."
# grubby --update-kernel=ALL --args="page_poison=1"
Fix execution completed and returned: 0
GRUB_CMDLINE_LINUX="... slub_debug=P ..."
# grubby --update-kernel=ALL --args="slub_debug=P"
Fix execution completed and returned: 0
$ sudo sysctl -w kernel.core_pattern=|/bin/false
kernel.core_pattern = |/bin/false
Fix execution completed and returned: 0
grep: /run/sysctl.d/*.conf: No such file or directory
grep: /usr/local/lib/sysctl.d/*.conf: No such file or directory

$ sudo sysctl -w kernel.dmesg_restrict=1
kernel.dmesg_restrict = 1
Fix execution completed and returned: 0
grep: /run/sysctl.d/*.conf: No such file or directory
grep: /usr/local/lib/sysctl.d/*.conf: No such file or directory

$ sudo sysctl -w kernel.kexec_load_disabled=1
kernel.kexec_load_disabled = 1
Fix execution completed and returned: 0
grep: /run/sysctl.d/*.conf: No such file or directory
grep: /usr/local/lib/sysctl.d/*.conf: No such file or directory

$ sudo sysctl -w kernel.perf_event_paranoid=2
kernel.perf_event_paranoid = 2
Fix execution completed and returned: 0
grep: /run/sysctl.d/*.conf: No such file or directory
grep: /usr/local/lib/sysctl.d/*.conf: No such file or directory

$ sudo sysctl -w kernel.unprivileged_bpf_disabled=1
kernel.unprivileged_bpf_disabled = 1
Fix execution completed and returned: 0
grep: /run/sysctl.d/*.conf: No such file or directory
grep: /usr/local/lib/sysctl.d/*.conf: No such file or directory

$ sudo sysctl -w kernel.yama.ptrace_scope=1
kernel.yama.ptrace_scope = 1
Fix execution completed and returned: 0
grep: /run/sysctl.d/*.conf: No such file or directory
grep: /usr/local/lib/sysctl.d/*.conf: No such file or directory

$ sudo sysctl -w net.core.bpf_jit_harden=2
net.core.bpf_jit_harden = 2
Fix execution completed and returned: 0
grep: /run/sysctl.d/*.conf: No such file or directory
grep: /usr/local/lib/sysctl.d/*.conf: No such file or directory

$ sudo sysctl -w user.max_user_namespaces=0
user.max_user_namespaces = 0
Fix execution completed and returned: 0
grep: /run/sysctl.d/*.conf: No such file or directory
grep: /usr/local/lib/sysctl.d/*.conf: No such file or directory

$ sudo dnf install policycoreutils-python-utils
$ sudo dnf install policycoreutils
$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"
$ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"
SELINUXTYPE=targeted

SELINUX=enforcing

$ sudo systemctl mask --now kdump.service
Fix execution completed and returned: 0
Removed "/etc/systemd/system/multi-user.target.wants/kdump.service".
Created symlink /etc/systemd/system/kdump.service → /dev/null.

$ sudo chgrp root /etc/cron.d
$ sudo chgrp root /etc/cron.daily
$ sudo chgrp root /etc/cron.deny
$ sudo chgrp root /etc/cron.hourly
$ sudo chgrp root /etc/cron.monthly
$ sudo chgrp root /etc/cron.weekly
$ sudo chgrp root /etc/crontab
$ sudo chown root /etc/cron.d 
$ sudo chown root /etc/cron.daily 
$ sudo chown root /etc/cron.deny 
$ sudo chown root /etc/cron.hourly 
$ sudo chown root /etc/cron.monthly 
$ sudo chown root /etc/cron.weekly 
$ sudo chown root /etc/crontab 
$ sudo chmod 0700 /etc/cron.d
$ sudo chmod 0700 /etc/cron.daily
$ sudo chmod 0700 /etc/cron.hourly
$ sudo chmod 0700 /etc/cron.monthly
$ sudo chmod 0700 /etc/cron.weekly
$ sudo chmod 0600 /etc/crontab
$ sudo dnf install fapolicyd
Fix execution completed and returned: 0
Last metadata expiration check: 2:48:55 ago on Wed Aug 21 09:50:07 2024.
Dependencies resolved.
================================================================================
 Package                  Arch       Version                Repository     Size
================================================================================
Installing:
 fapolicyd                x86_64     1.3.2-100.el9          appstream     133 k
Installing dependencies:
 rpm-plugin-fapolicyd     x86_64     4.16.1.3-29.el9        appstream      16 k
Installing weak dependencies:
 fapolicyd-selinux        noarch     1.3.2-100.el9          appstream      23 k

Transaction Summary
================================================================================
Install  3 Packages

Total download size: 172 k
Installed size: 332 k
Downloading Packages:
(1/3): rpm-plugin-fapolicyd-4.16.1.3-29.el9.x86  49 kB/s |  16 kB     00:00    
(2/3): fapolicyd-1.3.2-100.el9.x86_64.rpm       402 kB/s | 133 kB     00:00    
(3/3): fapolicyd-selinux-1.3.2-100.el9.noarch.r  70 kB/s |  23 kB     00:00    
--------------------------------------------------------------------------------
Total                                           332 kB/s | 172 kB     00:00     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : rpm-plugin-fapolicyd-4.16.1.3-29.el9.x86_64            1/3 
  Running scriptlet: fapolicyd-selinux-1.3.2-100.el9.noarch                 2/3 
  Installing       : fapolicyd-selinux-1.3.2-100.el9.noarch                 2/3 
  Running scriptlet: fapolicyd-selinux-1.3.2-100.el9.noarch                 2/3 
  Running scriptlet: fapolicyd-1.3.2-100.el9.x86_64                         3/3 
  Installing       : fapolicyd-1.3.2-100.el9.x86_64                         3/3 
  Running scriptlet: fapolicyd-1.3.2-100.el9.x86_64                         3/3 
  Running scriptlet: fapolicyd-selinux-1.3.2-100.el9.noarch                 3/3 
  Running scriptlet: fapolicyd-1.3.2-100.el9.x86_64                         3/3 
  Verifying        : fapolicyd-1.3.2-100.el9.x86_64                         1/3 
  Verifying        : fapolicyd-selinux-1.3.2-100.el9.noarch                 2/3 
  Verifying        : rpm-plugin-fapolicyd-4.16.1.3-29.el9.x86_64            3/3 
Installed products updated.

Installed:
  fapolicyd-1.3.2-100.el9.x86_64                                                
  fapolicyd-selinux-1.3.2-100.el9.noarch                                        
  rpm-plugin-fapolicyd-4.16.1.3-29.el9.x86_64                                   

Complete!

$ sudo systemctl enable fapolicyd.service
Fix execution completed and returned: 0
Created symlink /etc/systemd/system/multi-user.target.wants/fapolicyd.service → /usr/lib/systemd/system/fapolicyd.service.

 $ sudo dnf erase vsftpd
$ sudo echo "root: change_me@localhost" >> /etc/aliases
$ sudo newaliases
Fix execution completed and returned: 0
$ sudo grep "postmaster:\s*root$" /etc/aliases

postmaster: root
/etc/postfix/main.cf
$ sudo postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'
$ sudo dnf install s-nail
Fix execution completed and returned: 0
Last metadata expiration check: 2:49:13 ago on Wed Aug 21 09:50:07 2024.
Dependencies resolved.
================================================================================
 Package        Architecture   Version                  Repository         Size
================================================================================
Installing:
 s-nail         x86_64         14.9.22-6.el9            appstream         621 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 621 k
Installed size: 1.1 M
Downloading Packages:
s-nail-14.9.22-6.el9.x86_64.rpm                 516 kB/s | 621 kB     00:01    
--------------------------------------------------------------------------------
Total                                           450 kB/s | 621 kB     00:01     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Running scriptlet: s-nail-14.9.22-6.el9.x86_64                            1/1 
  Installing       : s-nail-14.9.22-6.el9.x86_64                            1/1 
  Running scriptlet: s-nail-14.9.22-6.el9.x86_64                            1/1 
  Verifying        : s-nail-14.9.22-6.el9.x86_64                            1/1 
Installed products updated.

Installed:
  s-nail-14.9.22-6.el9.x86_64                                                   

Complete!

$ sudo dnf erase sendmail
$ sudo dnf erase nfs-utils
$ sudo dnf install chrony
server <remote-server>
Fix execution completed and returned: 0
Fix execution completed and returned: 0
maxpoll 16

server
pool
Fix execution completed and returned: 0
No suitable fix found.
$ sudo dnf erase ypserv
$ sudo dnf erase rsh-server
$ sudo rm /[path]/[to]/[file]/shosts.equiv
$ sudo find / -name '.shosts' -type f -delete
$ sudo dnf erase telnet-server
 $ sudo dnf erase tftp-server
$ sudo systemctl show tftp | grep FragmentPath=
FragmentPath=/etc/systemd/system/tftp.service
ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot

 $ sudo dnf erase quagga
$ sudo ssh-keygen -n [passphrase]
No candidate or applicable check found.
Fix execution completed and returned: 0
ClientAliveInterval 600

Fix execution completed and returned: 0
HostbasedAuthentication no
Fix execution completed and returned: 0
firewall-cmd --permanent --add-service=ssh
firewall-cmd --reload
Fix execution completed and returned: 0
active
inactive
The firewalld or NetworkManager service is not active. Remediation aborted!

Failed to verify applied fix: Checking engine returns: fail
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "firewalld" ; then
    dnf install -y "firewalld"
fi
if ! rpm -q --quiet "NetworkManager" ; then
    dnf install -y "NetworkManager"
fi
firewalld_sshd_zone='public'

if test "$(stat -c %d:%i /)" != "$(stat -c %d:%i /proc/1/root/.)"; then
    # TODO: NM (nmcli) now has --offline mode support, and it could operate without NM service.
    # See: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1183
    # The feature is not quite straighforward (and probably incomplete), though.
    echo "Not applicable in offline mode. Remediation aborted!"
else
    if systemctl is-active NetworkManager && systemctl is-active firewalld; then
        # First make sure the SSH service is enabled in run-time for the proper zone.
        # This is to avoid connection issues when new interfaces are addeded to this zone.
        firewall-cmd --zone="$firewalld_sshd_zone" --add-service=ssh

        # This will collect all NetworkManager connections names
        readarray -t nm_connections < <(nmcli -f UUID,TYPE con | grep ethernet | awk '{ print $1 }')
        # If the connection is not yet assigned to a firewalld zone, assign it to the proper zone.
        # This will not change connections which are already assigned to any firewalld zone.
        for connection in "${nm_connections[@]}"; do
            current_zone=$(nmcli -f connection.zone connection show "$connection" | awk '{ print $2}')
            if [ $current_zone = "--" ]; then
                nmcli connection modify "$connection" connection.zone $firewalld_sshd_zone
            fi
        done
        systemctl restart NetworkManager

        # Active zones are zones with at least one interface assigned to it.
        # It is possible that traffic is comming by any active interface and consequently any
        # active zone. So, this make sure all active zones are permanently allowing SSH service.
        readarray -t firewalld_active_zones < <(firewall-cmd --get-active-zones | grep -v interfaces)
        for zone in "${firewalld_active_zones[@]}"; do
            firewall-cmd --permanent --zone="$zone" --add-service=ssh
        done
        firewall-cmd --reload
    else
        echo "The firewalld or NetworkManager service is not active. Remediation aborted!"
    fi
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

- name: XCCDF Value firewalld_sshd_zone # promote to variable
  set_fact:
    firewalld_sshd_zone: !!str public
  tags:
    - always

- name: Enable SSH Server firewalld Firewall Exception - Ensure firewalld and NetworkManager
    packages are installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - firewalld
  - NetworkManager
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-RHEL-09-251035
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - firewalld_sshd_port_enabled
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable SSH Server firewalld Firewall Exception - Collect facts about system
    services
  ansible.builtin.service_facts: null
  register: result_services_states
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-RHEL-09-251035
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - firewalld_sshd_port_enabled
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable SSH Server firewalld Firewall Exception - Remediation is applicable
    if firewalld and NetworkManager services are running
  block:

  - name: Enable SSH Server firewalld Firewall Exception - Collect NetworkManager
      connections names
    ansible.builtin.shell:
      cmd: nmcli -f UUID,TYPE con | grep ethernet | awk '{ print $1 }'
    register: result_nmcli_cmd_connections_names
    changed_when: false

  - name: Enable SSH Server firewalld Firewall Exception - Collect NetworkManager
      connections zones
    ansible.builtin.shell:
      cmd: nmcli -f connection.zone connection show {{ item | trim }} | awk '{ print
        $2}'
    register: result_nmcli_cmd_connections_zones
    changed_when: false
    with_items:
    - '{{ result_nmcli_cmd_connections_names.stdout_lines }}'

  - name: Enable SSH Server firewalld Firewall Exception - Ensure NetworkManager connections
      are assigned to a firewalld zone
    ansible.builtin.command:
      cmd: nmcli connection modify {{ item.0 }} connection.zone {{ firewalld_sshd_zone
        }}
    register: result_nmcli_cmd_connections_assignment
    with_together:
    - '{{ result_nmcli_cmd_connections_names.stdout_lines }}'
    - '{{ result_nmcli_cmd_connections_zones.results }}'
    when:
    - item.1.stdout == '--'

  - name: Enable SSH Server firewalld Firewall Exception - Ensure NetworkManager connections
      changes are applied
    ansible.builtin.service:
      name: NetworkManager
      state: restarted
    when:
    - result_nmcli_cmd_connections_assignment is changed

  - name: Enable SSH Server firewalld Firewall Exception - Collect firewalld active
      zones
    ansible.builtin.shell:
      cmd: firewall-cmd --get-active-zones | grep -v interfaces
    register: result_firewall_cmd_zones_names
    changed_when: false

  - name: Enable SSH Server firewalld Firewall Exception - Ensure firewalld zones
      allow SSH
    ansible.builtin.command:
      cmd: firewall-cmd --permanent --zone={{ item }} --add-service=ssh
    register: result_nmcli_cmd_connections_assignment
    changed_when:
    - '''ALREADY_ENABLED'' not in result_nmcli_cmd_connections_assignment.stderr'
    with_items:
    - '{{ result_firewall_cmd_zones_names.stdout_lines }}'

  - name: Enable SSH Server firewalld Firewall Exception - Ensure firewalld changes
      are applied
    ansible.builtin.service:
      name: firewalld
      state: reloaded
    when:
    - result_nmcli_cmd_connections_assignment is changed
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - ansible_facts.services['firewalld.service'].state == 'running'
  - ansible_facts.services['NetworkManager.service'].state == 'running'
  tags:
  - DISA-STIG-RHEL-09-251035
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - firewalld_sshd_port_enabled
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable SSH Server firewalld Firewall Exception - Informative message based
    on services states
  ansible.builtin.assert:
    that:
    - ansible_facts.services['firewalld.service'].state == 'running'
    - ansible_facts.services['NetworkManager.service'].state == 'running'
    fail_msg:
    - firewalld and NetworkManager services are not active. Remediation aborted!
    - This remediation could not be applied because it depends on firewalld and NetworkManager
      services running.
    - The service is not started by this remediation in order to prevent connection
      issues.
    success_msg:
    - Enable SSH Server firewalld Firewall Exception remediation successfully executed
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-RHEL-09-251035
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - firewalld_sshd_port_enabled
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

Compression no

Fix execution completed and returned: 0
PermitEmptyPasswords no
Fix execution completed and returned: 0
GSSAPIAuthentication no
Fix execution completed and returned: 0
KerberosAuthentication no
Fix execution completed and returned: 0
IgnoreRhosts yes
Fix execution completed and returned: 0
PermitRootLogin no
Fix execution completed and returned: 0
IgnoreUserKnownHosts yes
Fix execution completed and returned: 0
X11Forwarding no
Fix execution completed and returned: 0
PermitUserEnvironment no
Fix execution completed and returned: 0
UsePAM yes
PubkeyAuthentication yes
Fix execution completed and returned: 0
StrictModes yes
Fix execution completed and returned: 0
Banner /etc/issue
Fix execution completed and returned: 0
PrintLastLog yes
Fix execution completed and returned: 0
RekeyLimit 1G
                  1h

Fix execution completed and returned: 0
LogLevel VERBOSE
Fix execution completed and returned: 0
UsePrivilegeSeparation sandbox

Fix execution completed and returned: 0
Fix execution completed and returned: 0
$ sudo dnf install openssh-clients
$ sudo dnf install openssh-server
$ sudo systemctl enable sshd.service
$ sudo chgrp root /etc/ssh/sshd_config
$ sudo chown root /etc/ssh/sshd_config 
$ sudo chmod 0600 /etc/ssh/sshd_config
$ sudo chmod 0644 /etc/ssh/*.pub
Fix execution completed and returned: 0
[certmap/testing.test/rule_name]
matchrule =<SAN>.*EDIPI@mil
maprule = (userCertificate;binary={cert!bin})
domains = testing.test

No suitable fix found.
[pam]
pam_cert_auth = True

/etc/pam.d/system-auth:auth [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_sss.so try_cert_auth

/etc/pam.d/smartcard-auth:auth sufficient pam_sss.so allow_missing_name
Fix execution completed and returned: 0
Current configuration is valid.
Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.

- with-smartcard is selected, make sure smartcard authentication is enabled in sssd.conf:
  - set "pam_cert_auth = True" in [pam] section

Backup stored at /var/lib/authselect/backups/2024-08-21-12-39-27.VmWAkf
Changes were successfully applied.

No candidate or applicable check found.
[pam]
offline_credentials_expiration = 1

Fix execution completed and returned: 0
$ sudo dnf install usbguard
Fix execution completed and returned: 0
Last metadata expiration check: 2:49:21 ago on Wed Aug 21 09:50:07 2024.
Dependencies resolved.
================================================================================
 Package                Architecture Version              Repository       Size
================================================================================
Installing:
 usbguard               x86_64       1.0.0-15.el9         appstream       468 k
Installing dependencies:
 libqb                  x86_64       2.0.8-1.el9          appstream        91 k
 protobuf               x86_64       3.14.0-13.el9        appstream       1.0 M
Installing weak dependencies:
 usbguard-selinux       noarch       1.0.0-15.el9         appstream        22 k

Transaction Summary
================================================================================
Install  4 Packages

Total download size: 1.6 M
Installed size: 5.1 M
Downloading Packages:
(1/4): usbguard-selinux-1.0.0-15.el9.noarch.rpm  63 kB/s |  22 kB     00:00    
(2/4): usbguard-1.0.0-15.el9.x86_64.rpm         492 kB/s | 468 kB     00:00    
(3/4): protobuf-3.14.0-13.el9.x86_64.rpm        920 kB/s | 1.0 MB     00:01    
(4/4): libqb-2.0.8-1.el9.x86_64.rpm              95 kB/s |  91 kB     00:00    
--------------------------------------------------------------------------------
Total                                           1.1 MB/s | 1.6 MB     00:01     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : libqb-2.0.8-1.el9.x86_64                               1/4 
  Installing       : protobuf-3.14.0-13.el9.x86_64                          2/4 
  Running scriptlet: usbguard-selinux-1.0.0-15.el9.noarch                   3/4 
  Installing       : usbguard-selinux-1.0.0-15.el9.noarch                   3/4 
  Running scriptlet: usbguard-selinux-1.0.0-15.el9.noarch                   3/4 
  Installing       : usbguard-1.0.0-15.el9.x86_64                           4/4 
  Running scriptlet: usbguard-1.0.0-15.el9.x86_64                           4/4 
  Running scriptlet: usbguard-selinux-1.0.0-15.el9.noarch                   4/4 
  Running scriptlet: usbguard-1.0.0-15.el9.x86_64                           4/4 
  Verifying        : usbguard-selinux-1.0.0-15.el9.noarch                   1/4 
  Verifying        : usbguard-1.0.0-15.el9.x86_64                           2/4 
  Verifying        : protobuf-3.14.0-13.el9.x86_64                          3/4 
  Verifying        : libqb-2.0.8-1.el9.x86_64                               4/4 
Installed products updated.

Installed:
  libqb-2.0.8-1.el9.x86_64           protobuf-3.14.0-13.el9.x86_64             
  usbguard-1.0.0-15.el9.x86_64       usbguard-selinux-1.0.0-15.el9.noarch      

Complete!

$ sudo systemctl enable usbguard.service
Fix execution completed and returned: 0
Created symlink /etc/systemd/system/basic.target.wants/usbguard.service → /usr/lib/systemd/system/usbguard.service.

Fix execution completed and returned: 0
sudo dnf remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
$ systemctl set-default multi-user.target
Removed symlink /etc/systemd/system/default.target.
Created symlink from /etc/systemd/system/default.target to /usr/lib/systemd/system/multi-user.target.
-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S fremovexattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S fremovexattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S fremovexattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S fremovexattr -F auid=0 -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S fsetxattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S fsetxattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S fsetxattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S fsetxattr -F auid=0 -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S lremovexattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S lremovexattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S lremovexattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S lremovexattr -F auid=0 -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S lsetxattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S lsetxattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S lsetxattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S lsetxattr -F auid=0 -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S removexattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S removexattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S removexattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S removexattr -F auid=0 -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S setxattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S setxattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S setxattr -F auid=0 -F key=perm_mod
-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S setxattr -F auid=0 -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S umount -F auid>=1000 -F auid!=unset -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b32 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod
-a always,exit -F arch=b64 -S umount2 -F auid>=1000 -F auid!=unset -F key=perm_mod
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F arch=ARCH -S rename -F auid>=1000 -F auid!=unset -F key=delete
-a always,exit -F arch=ARCH -S rename -F auid>=1000 -F auid!=unset -F key=delete
Fix execution completed and returned: 0
-a always,exit -F arch=ARCH -S renameat -F auid>=1000 -F auid!=unset -F key=delete
-a always,exit -F arch=ARCH -S renameat -F auid>=1000 -F auid!=unset -F key=delete
Fix execution completed and returned: 0
-a always,exit -F arch=ARCH -S rmdir -F auid>=1000 -F auid!=unset -F key=delete
-a always,exit -F arch=ARCH -S rmdir -F auid>=1000 -F auid!=unset -F key=delete
Fix execution completed and returned: 0
-a always,exit -F arch=ARCH -S unlink -F auid>=1000 -F auid!=unset -F key=delete
-a always,exit -F arch=ARCH -S unlink -F auid>=1000 -F auid!=unset -F key=delete
Fix execution completed and returned: 0
-a always,exit -F arch=ARCH -S unlinkat -F auid>=1000 -F auid!=unset -F key=delete
-a always,exit -F arch=ARCH -S unlinkat -F auid>=1000 -F auid!=unset -F key=delete
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
Fix execution completed and returned: 0
-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
Fix execution completed and returned: 0
-a always,exit -F arch=ARCH -S delete_module -F auid>=1000 -F auid!=unset -F key=modules
Fix execution completed and returned: 0
-a always,exit -F arch=ARCH -S finit_module -F auid>=1000 -F auid!=unset -F key=modules
-a always,exit -F arch=ARCH -S finit_module -F auid>=1000 -F auid!=unset -F key=modules
Fix execution completed and returned: 0
-a always,exit -F arch=ARCH -S init_module -F auid>=1000 -F auid!=unset -F key=modules
Fix execution completed and returned: 0
-w /var/log/faillock -p wa -k logins
-w /var/log/faillock -p wa -k logins
Fix execution completed and returned: 0
-w /var/log/lastlog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
Fix execution completed and returned: 0
-w /var/log/tallylog -p wa -k logins
-w /var/log/tallylog -p wa -k logins
Fix execution completed and returned: 0
-a always,exit -F path=/usr/sbin/init -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/sbin/init -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/sbin/poweroff -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/sbin/poweroff -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/sbin/reboot -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/sbin/reboot -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/sbin/shutdown -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/sbin/shutdown -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/sbin/pam_timestamp_check
-F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/sbin/pam_timestamp_check
-F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh-agent
-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh-agent
Fix execution completed and returned: 0
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
Fix execution completed and returned: 0
-e 2
-e 2
Fix execution completed and returned: 0
-w /etc/sudoers -p wa -k actions
-w /etc/sudoers -p wa -k actions
Fix execution completed and returned: 0
-w /etc/sudoers.d/ -p wa -k actions
-w /etc/sudoers.d/ -p wa -k actions
Fix execution completed and returned: 0
$ sudo grep execve /etc/audit/audit.rules
$ sudo grep -r execve /etc/audit/rules.d
-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid
-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid
-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid
Fix execution completed and returned: 0
-f 2

-f 2

Fix execution completed and returned: 0
-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/group -p wa -k audit_rules_usergroup_modification
Fix execution completed and returned: 0
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
Fix execution completed and returned: 0
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
Fix execution completed and returned: 0
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
Fix execution completed and returned: 0
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
Fix execution completed and returned: 0
/var/log/audit/
$ sudo chgrp root /var/log/audit
/var/log/audit/
$ sudo chown root /var/log/audit 
$ sudo grep -iw log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log
$ sudo chmod 0600 audit_log_file

$ sudo grep log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log
$ sudo df -h /var/log/audit/
/dev/sda2 24G 10.4G 13.6G 43% /var/log/audit
No candidate or applicable check found.
$ sudo service auditd restart
Fix execution completed and returned: 0
disk_error_action = ACTION

Fix execution completed and returned: 0
disk_full_action = ACTION

Fix execution completed and returned: 0
action_mail_acct = root

admin_space_left_action = ACTION

Fix execution completed and returned: 0
admin_space_left = PERCENTAGE%
Fix execution completed and returned: 0
max_log_file_action = ACTION

space_left_action = ACTION

Fix execution completed and returned: 0
space_left = PERCENTAGE%
Fix execution completed and returned: 0
var_auditd_name_format
A|B|C
Fix execution completed and returned: 0
$ sudo dnf install audispd-plugins
Fix execution completed and returned: 0
Last metadata expiration check: 2:49:42 ago on Wed Aug 21 09:50:07 2024.
Dependencies resolved.
================================================================================
 Package                Architecture  Version               Repository     Size
================================================================================
Installing:
 audispd-plugins        x86_64        3.1.2-2.el9           baseos         51 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 51 k
Installed size: 118 k
Downloading Packages:
audispd-plugins-3.1.2-2.el9.x86_64.rpm          149 kB/s |  51 kB     00:00    
--------------------------------------------------------------------------------
Total                                            98 kB/s |  51 kB     00:00     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : audispd-plugins-3.1.2-2.el9.x86_64                     1/1 
  Running scriptlet: audispd-plugins-3.1.2-2.el9.x86_64                     1/1 
  Verifying        : audispd-plugins-3.1.2-2.el9.x86_64                     1/1 
Installed products updated.

Installed:
  audispd-plugins-3.1.2-2.el9.x86_64                                            

Complete!

$ sudo systemctl enable auditd.service
GRUB_CMDLINE_LINUX="... audit=1 ..."
# grubby --update-kernel=ALL --args="audit=1"
Fix execution completed and returned: 0
GRUB_CMDLINE_LINUX="... audit_backlog_limit=8192 ..."
# grubby --update-kernel=ALL --args="audit_backlog_limit=8192"
Fix execution completed and returned: 0

Evaluation target	rockykinux-rgs-djaga2
Benchmark URL	#scap_org.open-scap_comp_ssg-rhel9-xccdf.xml
Benchmark ID	xccdf_org.ssgproject.content_benchmark_RHEL-9
Benchmark version	0.1.73
Profile ID	xccdf_org.ssgproject.content_profile_stig
Started at	2024-08-21T12:40:12+00:00
Finished at	2024-08-21T12:40:12+00:00
Performed by	djagaazure
Test system	cpe:/a:redhat:openscap:1.3.10

Result of item-state comparison	Path	Content
false	/boot/loader/entries/41c1a55a253d4347ba8a12a9fcb0ee42-5.14.0-362.8.1.el9_3.x86_64.conf	options root=/dev/mapper/rocky-root ro rootdelay=300 console=ttyS0 earlyprintk=ttyS0 no_timer_check net.ifnames=0 crashkernel=1G-4G:192M,4G-64G:256M,64G-:512M rd.lvm.lv=rocky/root
false	/boot/loader/entries/0e8db0030bcd4de89b371ed146a40bda-5.14.0-427.28.1.el9_4.x86_64.conf	options root=/dev/mapper/rocky-root ro rootdelay=300 console=ttyS0 earlyprintk=ttyS0 no_timer_check net.ifnames=0 crashkernel=1G-4G:192M,4G-64G:256M,64G-:512M rd.lvm.lv=rocky/root
false	/boot/loader/entries/41c1a55a253d4347ba8a12a9fcb0ee42-0-rescue.conf	options root=/dev/mapper/rocky-root ro rootdelay=300 console=ttyS0 earlyprintk=ttyS0 no_timer_check net.ifnames=0 crashkernel=1G-4G:192M,4G-64G:256M,64G-:512M rd.lvm.lv=rocky/root
false	/boot/loader/entries/0e8db0030bcd4de89b371ed146a40bda-0-rescue.conf	options root=/dev/mapper/rocky-root ro rootdelay=300 console=ttyS0 earlyprintk=ttyS0 no_timer_check net.ifnames=0 crashkernel=1G-4G:192M,4G-64G:256M,64G-:512M rd.lvm.lv=rocky/root

Result of item-state comparison	Path	Content
false	/boot/loader/entries/41c1a55a253d4347ba8a12a9fcb0ee42-5.14.0-362.8.1.el9_3.x86_64.conf	options root=/dev/mapper/rocky-root ro rootdelay=300 console=ttyS0 earlyprintk=ttyS0 no_timer_check net.ifnames=0 crashkernel=1G-4G:192M,4G-64G:256M,64G-:512M rd.lvm.lv=rocky/root
false	/boot/loader/entries/0e8db0030bcd4de89b371ed146a40bda-5.14.0-427.28.1.el9_4.x86_64.conf	options root=/dev/mapper/rocky-root ro rootdelay=300 console=ttyS0 earlyprintk=ttyS0 no_timer_check net.ifnames=0 crashkernel=1G-4G:192M,4G-64G:256M,64G-:512M rd.lvm.lv=rocky/root
false	/boot/loader/entries/41c1a55a253d4347ba8a12a9fcb0ee42-0-rescue.conf	options root=/dev/mapper/rocky-root ro rootdelay=300 console=ttyS0 earlyprintk=ttyS0 no_timer_check net.ifnames=0 crashkernel=1G-4G:192M,4G-64G:256M,64G-:512M rd.lvm.lv=rocky/root
false	/boot/loader/entries/0e8db0030bcd4de89b371ed146a40bda-0-rescue.conf	options root=/dev/mapper/rocky-root ro rootdelay=300 console=ttyS0 earlyprintk=ttyS0 no_timer_check net.ifnames=0 crashkernel=1G-4G:192M,4G-64G:256M,64G-:512M rd.lvm.lv=rocky/root

Result of item-state comparison	Path	Content
not evaluated	/etc/sudoers.d/90-cloud-init-users	djagaazure ALL=(ALL) NOPASSWD:ALL
not evaluated	/etc/sudoers.d/omsagent	omsagent ALL=(ALL) NOPASSWD: /opt/microsoft/omsconfig/Scripts/OMSRsyslog.post.sh

Result of item-state comparison	Name	Arch	Epoch	Release	Version	Evr	Extended name
false	gpg-pubkey	(none)	(none)	5631588c	be1229cf	0:be1229cf-5631588c	gpg-pubkey-0:be1229cf-5631588c.(none)
false	gpg-pubkey	(none)	(none)	6279464b	350d275d	0:350d275d-6279464b	gpg-pubkey-0:350d275d-6279464b.(none)
false	gpg-pubkey	(none)	(none)	613798eb	3228467c	0:3228467c-613798eb	gpg-pubkey-0:3228467c-613798eb.(none)

Result of item-state comparison	Path	Content
true	/etc/aide.conf	ALLXTRAHASHES = sha1+rmd160+sha256+sha512+tiger
false	/etc/aide.conf	EVERYTHING = R+ALLXTRAHASHES
true	/etc/aide.conf	NORMAL = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha512
false	/etc/aide.conf	DIR = p+i+n+u+g+acl+selinux+xattrs
false	/etc/aide.conf	PERMS = p+u+g+acl+selinux+xattrs
false	/etc/aide.conf	LOG = p+u+g+n+S+acl+selinux+xattrs
true	/etc/aide.conf	CONTENT = sha512+ftype
true	/etc/aide.conf	CONTENT_EX = sha512+ftype+p+u+g+n+acl+selinux+xattrs
true	/etc/aide.conf	DATAONLY = p+n+u+g+s+acl+selinux+xattrs+sha512

Result of item-state comparison	Path	Content
true	/etc/passwd	bin:x:1:1:
true	/etc/passwd	daemon:x:2:2:
true	/etc/passwd	sync:x:5:0:
true	/etc/passwd	shutdown:x:6:0:
true	/etc/passwd	halt:x:7:0:
true	/etc/passwd	mail:x:8:12:
true	/etc/passwd	operator:x:11:0:
true	/etc/passwd	games:x:12:100:
true	/etc/passwd	ftp:x:14:50:
true	/etc/passwd	nobody:x:65534:65534:
true	/etc/passwd	systemd-coredump:x:999:997:
true	/etc/passwd	dbus:x:81:81:
true	/etc/passwd	polkitd:x:998:995:
true	/etc/passwd	sshd:x:74:74:
true	/etc/passwd	sssd:x:997:994:
true	/etc/passwd	tss:x:59:59:
true	/etc/passwd	chrony:x:996:993:
true	/etc/passwd	systemd-oom:x:991:991:
true	/etc/passwd	djagaazure:x:1000:1000:
true	/etc/passwd	mdatp:x:990:990:
true	/etc/passwd	omi:x:989:988:
true	/etc/passwd	omsagent:x:988:989:
true	/etc/passwd	nxautomation:x:987:986:
true	/etc/passwd	rtkit:x:172:172:
true	/etc/passwd	pipewire:x:986:985:
true	/etc/passwd	geoclue:x:985:984:
true	/etc/passwd	flatpak:x:984:983:
true	/etc/passwd	root:x:0:0:
true	/etc/passwd	adm:x:3:4:
true	/etc/passwd	lp:x:4:7:

Result of item-state comparison	Path	Content
not evaluated	/etc/pam.d/system-auth	auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so nullok auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_usertype.so issystem account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so local_users_only password sufficient pam_unix.so sha512 shadow nullok use_authtok
not evaluated	/etc/pam.d/password-auth	auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so nullok auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_usertype.so issystem account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so local_users_only password sufficient pam_unix.so sha512 shadow nullok use_authtok

Result of item-state comparison	Path	Content
true	/etc/passwd	djagaazure:x:1000:1000:Cloud User:/home/djagaazure:/bin/bash
false	/etc/passwd	omi:x:989:988::/home/omi:/bin/false
false	/etc/passwd	omsagent:x:988:989:OMS agent:/var/opt/microsoft/omsagent/run:/bin/bash
false	/etc/passwd	nxautomation:x:987:986:nxOMSAutomation:/home/nxautomation/run:/bin/bash

Result of item-state comparison	Path	Content
true	/etc/passwd	adm:
true	/etc/passwd	dbus:
true	/etc/passwd	polkitd:
true	/etc/passwd	sshd:
true	/etc/passwd	sssd:
true	/etc/passwd	tss:
true	/etc/passwd	chrony:
true	/etc/passwd	systemd-oom:
false	/etc/passwd	djagaazure:
false	/etc/passwd	mdatp:
false	/etc/passwd	omi:
false	/etc/passwd	omsagent:
false	/etc/passwd	nxautomation:
true	/etc/passwd	rtkit:
true	/etc/passwd	pipewire:
true	/etc/passwd	geoclue:
true	/etc/passwd	flatpak:
true	/etc/passwd	daemon:
true	/etc/passwd	bin:
true	/etc/passwd	lp:
true	/etc/passwd	sync:
true	/etc/passwd	shutdown:
true	/etc/passwd	halt:
true	/etc/passwd	mail:
true	/etc/passwd	operator:
true	/etc/passwd	games:
true	/etc/passwd	ftp:
true	/etc/passwd	nobody:
true	/etc/passwd	systemd-coredump:

Result of item-state comparison	Path	Type	UID	GID	Size (B)	Permissions
true	/root/.bash_history	regular	0	0	1948	`rw-------`
true	/root/.viminfo	regular	0	0	532	`rw-------`
false	/root/.cshrc	regular	0	0	100	`rw-r--r--`
false	/root/.tcshrc	regular	0	0	129	`rw-r--r--`
true	/home/djagaazure/.lesshst	regular	1000	1000	20	`rw-------`
true	/home/djagaazure/.viminfo	regular	1000	1000	9436	`rw-------`
false	/root/.bash_logout	regular	0	0	18	`rw-r--r--`
false	/root/.bash_profile	regular	0	0	141	`rw-r--r--`
false	/root/.bashrc	regular	0	0	429	`rw-r--r--`
false	/home/djagaazure/.bash_logout	regular	1000	1000	18	`rw-r--r--`
false	/home/djagaazure/.bash_profile	regular	1000	1000	141	`rw-r--r--`
false	/home/djagaazure/.bashrc	regular	1000	1000	492	`rw-r--r--`
true	/home/djagaazure/.bash_history	regular	1000	1000	9881	`rw-------`
false	/home/djagaazure/.gitconfig	regular	1000	1000	54	`rw-r--r--`

Result of item-state comparison	Unit	Property	Value
true	systemd-journald.socket	ActiveState	active
true	systemd-journald.service	ActiveState	active

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.accept_ra=0
true	/etc/sysctl.conf	net.ipv6.conf.all.accept_ra=0

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.accept_redirects=0
true	/etc/sysctl.conf	net.ipv6.conf.all.accept_redirects=0

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv6.conf.all.accept_source_route=0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.accept_source_route=0

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv6.conf.all.forwarding=0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.all.forwarding=0

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.default.accept_ra=0
true	/etc/sysctl.conf	net.ipv6.conf.default.accept_ra=0

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv6.conf.default.accept_source_route=0
true	/etc/sysctl.conf	net.ipv6.conf.default.accept_source_route=0

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.conf.all.accept_redirects=0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.accept_redirects=0

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.accept_source_route=0
true	/etc/sysctl.conf	net.ipv4.conf.all.accept_source_route=0

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.conf.all.log_martians=1
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.log_martians=1

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.conf.all.rp_filter=1
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.rp_filter=1

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.accept_source_route=0
true	/etc/sysctl.conf	net.ipv4.conf.default.accept_source_route=0

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.log_martians=1
true	/etc/sysctl.conf	net.ipv4.conf.default.log_martians=1

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.conf.default.rp_filter=1
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.rp_filter=1

Guide to the Secure Configuration of Red Hat Enterprise Linux 9

Evaluation Characteristics

CPE Platforms

Addresses

Compliance and Scoring

Rule results

Severity of failed rules

Score

Rule Overview

Result Details

Install AIDE

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

Build and Test AIDE Database

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

Testing existence of operational aide database file oval:ssg-test_aide_operational_database_absolute_path:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_operational_database_absolute_path:obj:1 of type file_object

Configure AIDE to Verify the Audit Tools

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

auditctl is checked in /etc/aide.conf oval:ssg-test_aide_verify_auditctl:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_verify_auditctl:obj:1 of type textfilecontent54_object

auditd is checked in /etc/aide.conf oval:ssg-test_aide_verify_auditd:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_verify_auditd:obj:1 of type textfilecontent54_object

ausearch is checked in /etc/aide.conf oval:ssg-test_aide_verify_ausearch:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_verify_ausearch:obj:1 of type textfilecontent54_object

aureport is checked in /etc/aide.conf oval:ssg-test_aide_verify_aureport:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_verify_aureport:obj:1 of type textfilecontent54_object

autrace is checked in /etc/aide.conf oval:ssg-test_aide_verify_autrace:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_verify_autrace:obj:1 of type textfilecontent54_object

rsyslogd is checked in /etc/aide.conf oval:ssg-test_aide_verify_rsyslogd:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_verify_rsyslogd:obj:1 of type textfilecontent54_object

augenrules is checked in /etc/aide.conf oval:ssg-test_aide_verify_augenrules:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_verify_augenrules:obj:1 of type textfilecontent54_object

Configure Periodic Execution of AIDE

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

run aide with cron oval:ssg-test_aide_periodic_cron_checking:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_test_aide_periodic_cron_checking:obj:1 of type textfilecontent54_object

run aide with cron oval:ssg-test_aide_crond_checking:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_test_aide_crond_checking:obj:1 of type textfilecontent54_object

run aide with cron oval:ssg-test_aide_var_cron_checking:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_var_cron_checking:obj:1 of type textfilecontent54_object

run aide with cron.(daily|weekly) oval:ssg-test_aide_crontabs_checking:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_crontabs_checking:obj:1 of type textfilecontent54_object

Configure Notification of Post-AIDE Scan Details

package aide is installed oval:ssg-test_package_aide_installed:tst:1 true

Following items have been found on the system:

notify personnel when aide completes oval:ssg-test_aide_scan_notification:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_test_aide_scan_notification:obj:1 of type textfilecontent54_object

notify personnel when aide completes oval:ssg-test_aide_var_cron_notification:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_var_cron_notification:obj:1 of type textfilecontent54_object

notify personnel when aide completes in cron.(daily|weekly|monthly) oval:ssg-test_aide_crontabs_notification:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-object_aide_crontabs_notification:obj:1 of type textfilecontent54_object

Configure AIDE to Use FIPS 140-2 for Validating Hashes

installed OS part of unix family oval:ssg-test_rhel7_unix_family:tst:1 true

Following items have been found on the system:

redhat-release-client is version 7 oval:ssg-test_rhel7_client:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_client:obj:1 of type rpminfo_object

redhat-release-workstation is version 7 oval:ssg-test_rhel7_workstation:tst:1 false

No items have been found conforming to the following objects:

Object oval:ssg-obj_rhel7_workstation:obj:1 of type rpminfo_object

redhat-release-server is version 7 oval:ssg-test_rhel7_server:tst:1 false

Result of item-state comparison	Path	Content
true	/usr/lib/sysctl.d/50-redhat.conf	net.ipv4.conf.default.rp_filter = 1
false	/usr/lib/sysctl.d/50-default.conf	net.ipv4.conf.default.rp_filter = 2

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.icmp_echo_ignore_broadcasts=1
true	/etc/sysctl.conf	net.ipv4.icmp_echo_ignore_broadcasts=1

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.icmp_ignore_bogus_error_responses=1
true	/etc/sysctl.conf	net.ipv4.icmp_ignore_bogus_error_responses=1

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.tcp_syncookies=1
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.tcp_syncookies=1

Result of item-state comparison	Path	Content
true	/etc/sysctl.conf	net.ipv4.conf.all.send_redirects=0
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.all.send_redirects=0

Result of item-state comparison	Path	Content
true	/etc/sysctl.d/99-sysctl.conf	net.ipv4.conf.default.send_redirects=0
true	/etc/sysctl.conf	net.ipv4.conf.default.send_redirects=0

Result of item-state comparison	Mount point	Device	Uuid	Fs type	Mount options	Mount options	Mount options	Mount options	Mount options	Mount options	Mount options	Mount options	Mount options	Total space	Space used	Space left
true	/boot/efi	/dev/sda1	6BDD-84EA	vfat	rw	relatime	fmask=0077	dmask=0077	codepage=437	iocharset=ascii	shortname=winnt	errors=remount-ro	bind	50574	3587	46987
true	/boot	/dev/sda2	9dd560e5-b943-4e7f-b05f-e79021d9b117	xfs	rw	seclabel	relatime	attr2	inode64	logbufs=8	logbsize=32k	noquota	bind	239616	109048	130568
true	/mnt	/dev/sdb1	9760ea26-9e06-420f-a1d7-cc4d5eaf5b07	ext4	rw	seclabel	relatime	bind	4100319	7	4100312

Result of item-state comparison	Unit	Property	Value
true	sshd.service	ActiveState	active
false	sshd.socket	ActiveState	inactive